Result of a security test online

[Hjertesvikt]

Hi all,

I tested https:www.htmly.com with several online security tools like sitecheck.sucuri.net/ Here is what they found:

• Missing security header for ClickJacking Protection. Alternatively, you can use Content-Security-Policy: frame-ancestors 'none'.

• Missing security header to prevent Content Type sniffing.

• Missing Strict-Transport-Security security header.

• Missing Content-Security-Policy directive.

• Response headers do not include the HTTP X-Frame-Options security header

• Response headers do not include the HTTP X-XSS-Protection security header

• Response headers do not include the X-Content-Type-Options HTTP security header

• Response headers do not include the Referrer-Policy HTTP security header

I wonder in which file there is a need for making changes?

Thanks for maintaining HTMLy, its a beautiful software.

Jean-Pierre

[danpros]

Hi, you are welcome.

It can be specify via theme or server headers (mod_headers) etc.

[ProjectPatatoe]

Most, if not all, would normally be done in the web server config files or in the site definition. Just for quick reference: phpbb and MediaWiki would show the same messages.